GitHub Advisoryadvisory · npm

GHSA-wqgx-4q47-j2w5 Insecure Cryptography Algorithm in parsel

CRITICAL Published 2020-09-04 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
parsel
Severity
Critical
Weaknesses
CWE-327
Reviewed
2020-08-31

Affected packages

• npm parsel: >= 0.0.0 (no fix yet)

Description

All versions of `parsel` use an insecure cryptography algorithm. The package uses `aes-256-cbc` without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks. Recommendation The package is deprecated and will not be updated. Consider using an alternative package.

Related

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References